Chapter 7 — Passwords and authenticators | Technologist Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Passwords and authenticators

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Password guidance"]
  N2["7.2 Authenticator types"]
  N3["7.3 Planning stronger sign-in"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Password guidance"]
  N2["7.2 Authenticator types"]
  N3["7.3 Planning stronger sign-in"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Password guidance]
    |
    v
[7.2 Authenticator types]
    |
    v
[7.3 Planning stronger sign-in]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) explain current password guidance; (2) compare authenticator types; (3) plan stronger sign-in for Fernhill.

7.1 Password guidance

NIST SP 800-63B gives modern guidance on passwords. It favours longer passwords, checking new passwords against lists of known compromised or common ones, and avoiding forced periodic changes unless there is evidence of compromise. It also advises against composition rules such as requiring a symbol, which tend to produce predictable patterns. Kai finds Fernhill's directory forces changes every 60 days and requires symbols. He proposes a change to the guidance-based policy, with a screening list, which the practice manager approves after he explains the reasons.

7.2 Authenticator types

Authenticators differ in strength. A password alone is one factor that can be guessed or phished. Codes sent by text add a factor but can be intercepted or redirected. Authenticator apps are stronger. Passkeys based on FIDO2 and the W3C WebAuthn standard are phishing-resistant, because they only work with the genuine site and never send a reusable secret. Kai explains these differences in a simple table for Fernhill's staff, with ease of use alongside strength, since staff adoption matters too.

7.3 Planning stronger sign-in

Kai plans a step-by-step move: first, multi-factor authentication for everyone using an authenticator app; second, passkeys for finance, IT and the practice manager, who hold the most powerful access; third, passkeys for all staff as devices allow. Shared reception workstations need careful thought, because a personal factor must still be used quickly. He records each step with dates, owners and a fallback recovery process, so nobody is locked out when they lose a phone. He also plans a short staff session explaining each step before it starts, so nobody is surprised.

Worked example

The new policy drops 60-day expiry and symbol rules and adds a screening list; MFA reaches 79 of 85 staff in six weeks.

Synthetic case. Policies and figures are synthetic; NIST SP 800-63B and W3C WebAuthn are real sources.

Errors and limits

Forcing frequent password changes without evidence of compromise tends to produce weaker, predictable passwords.

Exercises

EX019 — Forced changes. What does NIST SP 800-63B say about forced periodic changes? Rubric: 3 = avoid unless evidence of compromise;; 2 = avoid;; 1 = monthly;; 0 = none.
EX020 — Phishing resistance. Why are passkeys phishing-resistant? Rubric: 3 = only work with the genuine site, no reusable secret;; 2 = site-bound;; 1 = long;; 0 = none.
EX021 — MFA progress. How many staff had MFA after six weeks? Rubric: 3 = 79 of 85;; 2 = 79;; 1 = 85;; 0 = none.

Synthesis

Guidance-based password policy and phishing-resistant authenticators raise sign-in strength without burdening staff.

Continue studying — chapter 07 of 30

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →